About us

Privacy Policy

Orbit Car Hire privacy policy

1. With this Privacy Policy and Terms of Use Orbit Car Hire EHF. Lyngás 18, 210 Garðabær,  Iceland, registered at the District Court in Reykjavik, VAT ID number: 550920-1660 it  website, users of services, customers and other persons with whom they are entering into a contractual relationship (hereinafter referred to as users) information about personal data processing in accordance with the legislation in force.

2. The  website is a car rental booking system that allows the user (depending on availability) to book cars at different car rental service providers at different locations and in different countries (in the EU and outside the EU).

The user concludes a car rental contract directly with the car rental service provider with whom the user booked the car through the booking system. The protection of personal data that the user gave directly to the car rental service provider (eg when concluding a car rental contract) is the subject of the provisions of such contract between the user and the provider of the car rental service (considering the legislation in force in the country of rental). Please note that some car rental service providers may have GPS tracking systems installed in some or all of their vehicles subject to the policies of such car rental service providers.

The definitions used in the Policy shall have the same meaning as defined in the Terms of Use in force.

3. The user hereby agrees and undertakes:

  • To submit the following personal data: name and surname, age, telephone number, email address, address, country of residence, credit or debit card number and data on the user regarding payment for the booking or advance payment for the purpose of the booking procedure through the representative (and thus for the purpose of executing the contract between the representative and the user);
  • That the data referred to in the preceding paragraph are necessary for carrying out the booking as well as for the subsequent implementation of the contract, and consequently, the user allows their personal data to be sent to the car rental service provider, and contract agent for carrying out the booking, an organization for carrying out security checking of the credit or debit cards or contract partner for providing various services associated with the implementation of the contract, eg payment processing services.

4. By using the  website the user is aware of and acknowledges the following:

  • Their personal data (data for which the user granted explicit consent as well as the data that have to be processed for meeting the contractual and statutory obligations, and the data on credit cards collected during the use of the booking system), are handled in accordance with the legislation in force in the territory of Iceland, in particular the General Data Protection Regulation (GDPR), and the Personal Data Protection Act;
  • Each processing and the purpose of processing the user's personal data is evident from one of the valid bases for data processing, ie from:
    • The contract (personal data which are required for the conclusion and implementation of the contract and for meeting the required contractual obligations),
    • Legislation (personal data that must be collected and/or kept under regulatory provisions),
    • Explicit consent by the user to personal data processing (only for the data and for the purpose for which the user has granted explicit consent. In cases where personal data processing is based on the consent by the user, such consent may be withdrawn at any time );
  • Personal data may be processed also based on a legitimate interest, ie for conducting statistical surveys and/or analysis, which can be conducted with the purpose of continuously improving the user experience and quality of services, and for further planning and development of the services provided. A minimal scope of personal data along with anonymization and pseudonymization are considered within statistical surveys and analysis so that the used personal data do not allow the identification of an individual user at all;
  • Consents may be withdrawn in writing using a special contact form. In case the user withdraws their consent to personal data processing, the controller stops processing the personal data collected based on the consent, or stops processing them for the purpose for which the consent was granted;
  • Users of the personal data are Orbit Car Hire EHF., and Orbit Car Hire EHF. contractual partners as well as state bodies, whereby each use of personal data by Orbit Car Hire EHF. contract partners are based on a contractual relationship that meets the requirements regarding personal data processing and protection; access to personal data is allowed only for the purpose and in the scope necessary for providing the service;
  • Personal data necessary for ensuring an appropriate level and provision of the service can be, in accordance with appropriate and relevant safeguards (eg encryption), transferred to Iceland where the data will be stored for processing and use;
  • That the user's personal data, used for the purpose of booking procedures and thus the implementation of the contract, can be sent, in accordance with the appropriate and relevant safeguards, to a country where the contract is implemented, which does not have equal safety standards regarding safety and personal data processing by using the required technical protection of personal data (eg encryption);
  • That the user's email address will be used for notifying the user about the booking itself, including sending confirmation or changes to the booking and informing them about updates and changes on the representative's website, when this refers to the implementation of the contract itself;
  • That the user's telephone number will be used only in emergencies related to the implementation of the contract, such as a breakdown or problems with the user's booking;
  • That the representative can send providers and partners anonymised statistical data on the users, which never include their personal data and thus prevent identification of an individual user;
  • That personal data is kept and processed until the validity of the contractual relationships expires or until the contractual obligations are settled and met, or all claims have fallen under the statute of limitation. Certain personal data are kept in accordance with the legislation in force (eg 10 years for certain data under tax and financial provisions), for the purpose of meeting obligations under the rules in force, and for the purpose of implementing or responding to pleas, if any, which could arise directly from the relationship between the user and Orbit Car Hire EHF. or from the relationship between Orbit Car Hire EHF. and third parties;
  • Has the right to print out or access the collected personal data and the right to correct personal data if the user is of the opinion that the processed personal data are not correct; right to deletion or limitation of data processing if they are not necessary for the implementation of the contract or meeting statutory obligations; right to file an objection regarding personal data processing on the basis of statutory interest, and the right to transferability of personal data. The user may exercise all of the above using a special contact form;
  • In case the user is of the opinion that the processing of personal data is breached, a complaint may be filed using a special contact form available at the supervisory body (Information Commissioner);
  • Those personal data are accessed via a server that uses up-to-date technologies to protect personal data (eg 256-bit encryption);
  • The use of the safety system is available only at the subpage where the user can see or enter their personal data;
  • The locked lock icon indicates that the user is on a website with a secure connection, while the icon of a lock with a red cross (Google Chrome), grey lock with a red lightning bolt (Mozilla Firefox), or a warning Internet Explorer, Bing) indicates that the user is on an unprotected page.

5. E-news

The user agrees with an explicit or separate application (Mailerlite) that the personal data, provided when subscribing to the e-news, are used or processed for sending messages related to the representative's operation (campaigns, news, information about prize competitions and other marketing activities, general information about the representative) to their email address.

Such consent to receiving e-news can be withdrawn at any time. The cancellation can be done within the sent e-news by clicking the link "Unsubscribe" or by sending a notice of cancellation to the email address:

6. The representative hereby agrees and undertakes: to process and keep the user's personal data in accordance with the legislation in force in Iceland.

7. The user has been informed and acknowledges the fact that the security of data during credit card processing is provided by the outsourcer Rapyd, which is an authorized provider of such services.

8. The Policy concerned is available at  and enters into force on 15th September 2020th